In previous skills, we walked through configuring a passive interface.
And for IPv4 using OSPF version 3, it's a little bit different than the
traditional flavor of OSPF for IPv4.
So let's remind ourselves, first of all, why we would ever want to make an
interface a passive interface.
If we knew that here on router well, we would never have any OSPF neighbors off
of this segment,
it would be beneficial to set that interface as passive.
And that way we're not going to be sending or processing incoming hello
messages. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And as a result, there's no possible way that we would be revealing information
to a hacker or somebody else who's out here.
And if we accidentally have another OSPF speaker here or from the attacker put
the OSPF speaker here,
we're not going to accidentally form an adjacency with some unknown device.
Because we're no longer sending and processing any inbound hello messages if we
have a passive interface.
So one question might be, "Will Keith, why not just not enable OSPF version 3
for address family IPv4 at all on this interface?"
Well, if we don't enable this interface for OSPF version 3, we're not going to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Well, if we don't enable this interface for OSPF version 3, we're not going to
be advertising the 10-01 subnet.
And so if you want reachability back to this 10-01 subnet, which you do if you
have clients here and so forth,
we'd want to go ahead and make sure we're including that in OSPF.
But for the benefit of security, we can make it passive.
And that way we can restrict the sending of any hello messages and if there are
inbound hello messages, we're just going to drop them,
we're not going to process them or believe them.
So to demonstrate this, let me take an interface.
Let's take serial 3/1 down here in our 7.
We don't currently have OSPF enabled over here at all. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We don't currently have OSPF enabled over here at all.
So let's imagine that we want to enable this interface, serial 3/1 for OSPF
version 3, process ID1 for the address family IPv4,
because we want that network 10-78-0 to be advertising OSPF.
But at the same time, we don't want the ability to form an adjacency with
anybody off of that segment.
So let's take a two-step approach here.
First, we'll enable OSPF-3 for address family IPv4 on this interface.
We'll verify that that route is then seen by the rest of the network.
And then we'll go in further and we'll set serial 3/1 as a passive interface in WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then we'll go in further and we'll set serial 3/1 as a passive interface in
OSPF to prevent any kind of
naborship ever forming should some other device try to neighbor up with us.
So the first thing I like to do in our topology is just verify that in our 7,
this serial 3/1 interface
is up and does have an IP address.
So let's go over to our 7 and here on our 7, let's go ahead and do a show IP
interface brief.
And there it is, serial 3/1, 10-78-07.
The other router, our 8, even though it doesn't have OSPF enabled over there on WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The other router, our 8, even though it doesn't have OSPF enabled over there on
its serial 3/2 interface.
Let's just take a look at the picture real quick.
What we should be able to do is ping it because we're directly connected.
Let's just ping and verify we can get over there.
So do a ping over to 10.78.08 and that looks good.
We can also do a show, CDP neighbors, just to verify that our 8's hanging off
that connection.
And it is fantastic.
So let's go into a show OSPF B3 interface brief.
And I'm leaving off the IPv4, IPv6 before the interface command because we're WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And I'm leaving off the IPv4, IPv6 before the interface command because we're
only running IPv4.
So great, I've got these two interfaces. Let's go ahead and go into the serial
3/1 and add it to the
party with the command OSPF version 3, process ID1, IPv4, and area.
This is going to be an area 1 as all the other interfaces are.
Press enter.
And now if we do a show OSPF version 3, interface brief, that also means that
if we go to another router.
For example, let's go up to router 1. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
For example, let's go up to router 1.
We should be able to see that route as an interarea OSPF route for 10.78.0
because our 7
is including that. And that's being forwarded as a LSA type 3 by R3 up into
area 0.
So if we go to R1 and here on R1, if we do a show IP route, press enter.
That this is a show IP route, OSPF B3.
So you can see just the OSPF learned routes.
And there is that network right there.
This is the 10.78.0 network.
So our next step, let's go down to R7 and let's do a debug of OSPF B3 hello WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So our next step, let's go down to R7 and let's do a debug of OSPF B3 hello
messages.
And we'll verify that currently it's sending out hello messages on serial 3/1.
And then after we make it passive, those hello messages on that interface will
stop.
So let's go back to R7 and let's do a debug OSPF version 3 hello.
Just like that.
And we'll wait till we get at least one or two messages that indicate they're
going out serial 3/1.
All right, so there's one of them and there is another one.
So I'll go ahead and do an undybug all. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So I'll go ahead and do an undybug all.
And again, notice they're using IPv6 multicast addresses to send those hello.
Another reminder that IPv6 needs to be enabled on the interfaces if you want OS
PF version 3 to work.
In fact, I'm going to leave the debug on and let's go into router configuration
mode.
Let's do a do show run section router.
And then I can just copy paste as we go in.
So I'm going to go into router OSPF B3, process ID1.
Then I'm going to go into the address family for IPv4 unicast.
And then from here, I'm going to go ahead and say passive interface serial 3/1. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then from here, I'm going to go ahead and say passive interface serial 3/1.
And once we do that, the hello messages that we're being sent through serial 3/
1,
those should no longer be sent.
And that's because serial 3/1 is passive.
So the network that it's connected to, and that's this one right here, the 1078
,
is still being advertised in OSPF.
But serial 3/1 is no longer sending hello messages for OSPF.
And if it receives a hello message, it's not going to process it.
So we have no risk of forming an adjacency over that serial link or that
network segment
because we're not processing the lows. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
because we're not processing the lows.
All right, so I'm going to go ahead and leave that in place.
Let's take an undybug all and let's do a show run section router.
So that's exactly how we enable passive interface for IPv4.
So we simply went into the routing process.
We went further into the address family for IPv4 unicast.
And specified that serial 3/1 is a passive interface.
Which caused it to stop sending hello messages off of that interface.
But at the same time, we go to R1 and we look at the routing table there.
We still have the OSPF Interarea route for 1078-0.
And in the next video, I'd like to walk you through the setting up of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And in the next video, I'd like to walk you through the setting up of
Stubb and totally stubby areas for IPv4 using OSPF version 3.
So I'll see you there in just a moment.